CVE-2026-111044

Received Received - Intake

Authentication Bypass via Paired Client Certificates in Sunshine

Publication date: 2026-10-16

Last updated on: 2026-10-16

Assigner: GitHub, Inc.

Description

Sunshine is a self-hosted game stream host for Moonlight. From 2026.329.165800 until 2026.906.222525, Sunshine accepted any client certificate that chained to a stored paired-client certificate, but it did not require the presented certificate to be the exact enabled paired identity. Certificate text was also compared without canonicalizing equivalent PEM encodings. A previously paired client that retains its private key can present an alternate certificate derived from its paired certificate and bypass the Disable control. Equivalent PEM encodings could also cause inconsistent client identity handling. A client that was never paired cannot use this issue, and removing the paired client removes its trust relationship. This issue is fixed in version 2026.906.222525.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-16

Last Modified

2026-10-16

Generated

2026-10-17

AI Q&A

2026-10-17

EPSS Evaluated

N/A

NVD

CVE-2026-111044

Affected Vendors & Products

Vendor	Product	Version / Range
LizardByte	Sunshine	>= 2026.329.165800, < 2026.906.222525

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

Executive Summary

Sunshine is a self-hosted game stream host for Moonlight. Between versions 2026.329.165800 and 2026.906.222525, it accepted any client certificate that chained to a stored paired-client certificate without verifying the exact enabled paired identity. This allowed a previously paired client with its private key to bypass controls by presenting an alternate certificate derived from the paired one. Equivalent PEM encodings also caused inconsistent client identity handling.

Detection Guidance

Check Sunshine server logs for unexpected client certificate authentications. Verify paired client certificates in the configuration files and compare them with active connections. Look for clients using alternate PEM encodings of paired certificates.

Impact Analysis

An attacker with a previously paired client's private key could bypass authentication and gain unauthorized access to the Sunshine server. This could allow them to stream games or access sensitive data. Clients that were never paired are unaffected, and removing a paired client revokes its access.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. It undermines access controls and may result in non-compliance with data protection regulations due to potential data breaches.

Mitigation Strategies

Upgrade Sunshine to version 2026.906.222525 or later. Remove and re-pair all existing client certificates to ensure only the exact enabled paired identity is trusted. Review and update access controls to enforce strict certificate matching.

Hi! I’m here to help you understand CVE-2026-111044. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70